use MD5 directly instead of EVP, in preparation for CommonCrypto port
use CommonCrypto instead of OpenSSL on OS X to avoid deprecations; it is slightly slower though